Question 1

http.createServer vs frameworks — when is bare http enough?

Accepted Answer

Bare http for tiny services/learning; frameworks for routing, middleware, validation at scale. Know the core API anyway — frameworks wrap it. For ultra-low overhead proxies, raw http/http2 may win.

Question 2

How do you handle request body parsing safely?

Accepted Answer

Use size limits, content-type checks, and streaming parsers; reject unexpected types. Unbounded JSON parsing enables DoS. Prefer established middleware with limits. Don't eval bodies.

Question 3

What headers matter for reverse-proxy deployments?

Accepted Answer

X-Forwarded-For/Proto/Host — but only trust them from known proxies. Misconfigured trust causes IP spoofing and insecure cookie flags. Use framework 'trust proxy' carefully.

Question 4

HTTP/2 or HTTP/3 in Node services — practical take?

Accepted Answer

Often terminated at the load balancer; Node may speak HTTP/1.1 upstream. Know where TLS and multiplexing happen. Enabling http2 in Node has trade-offs (compatibility, push rarely useful). Focus on correct proxy headers and keep-alives.

Question 5

How do you design idempotent APIs in Node?

Accepted Answer

Idempotency keys for POSTs, safe retries, and dedupe stores with TTLs. Critical for payments and webhooks. Combine with exactly-once-ish processing patterns at the consumer.

Question 6

Debugging: intermittent 502s from Node behind nginx.

Accepted Answer

Check upstream timeouts, keep-alive mismatches, unhandled crashes, and slow event loop. Align proxy_read_timeout with app. Ensure health checks hit a lightweight route. Inspect crash logs and OOM kills.

APIs Node.js Interview Questions

Other Node.js interview topics